Web application scanners are specialised tools used to examine the security of web applications. These tools test for web-specific vulnerabilities, such as [[SQL Injection]], cross-site scripting ([[Cross-site Scripting|XSS]]), and cross-site request forgery ([[Cross-Site Request Forgery|CSRF]]) vulnerabilities. They work by combining traditional network scans of web servers with detailed probing of web applications using such techniques as sending known malicious input sequences and fuzzing in attempts to break the application. *Nikto* is a popular web application scanning tool. It is an open source tool that is freely available for anyone to use. Another open source tool available for web application scanning is *Arachni*. This tool is a packaged scanner available for Windows, macOS, and Linux operating systems. Although there are dedicated web application scanners, such as *Acunetix*, on the market, *many firms use the web application scanning capabilities of traditional network vulnerability scanners*, such as Nessus, Qualys, and Nexpose.